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Foreword 

This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under 
http ://webapp . etsi.org/kev/queryform. asp . 
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Foreword 



id , 



This Technical Specification (TS) has been produced for the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 



rd , 



The present document is part of a TS-family covering the 3 Generation Partnership Project; Technical Specification 
Group Services and System Aspects; Telecommunication management; as identified below: 

TS 32.331 "Notification Log (NL) Integration Reference Point (IRP); Requirements" 

TS 32.332 "Notification Log (NL) (NL) Integration Reference Point (IRP); Information Service (IS)" 

TS 32.333 "Notification Log (NL) Integration Reference Point (IRP); Common Object Request Broker 

Architecture (CORBA) Solution Set (SS)" 

TS 32.335 "Notification Log (NL) Integration Reference Point (IRP); extensible Markup Language (XML) 

solution definitions" 

The present document describes the requirements and information model necessary for Telecommunications 
Management (TM). The TM principles and TM architecture are specified in 3GPP TS 32.101 [1] and 
3GPP TS 32.102 [2] respectively. 

A communications system is composed of a multitude of Network Elements (NE) of various types and, typically, 
different vendors, which inter-operate in a co-ordinated manner in order to satisfy the network users" communication 
requirements. 

The occurrence of faults in an NE may cause deterioration or loss of this NE"s function. Fault Management is the 
functional area, which allows the operator to detect the occurrence of faults in the network in real-time. Configuration 
Management and Performance Management are two more functional areas, which require the operator to be alerted to 
certain conditions in the network. 

A standard general-purpose mechanism for the management of Notification Logs containing selected or all notifications 
from the network is required to provide an ability to perform historical analysis on faults and conditions, which 
occurred in the network. The TS 32.33x-series constituting the Notification Log IRP, sets forth such a mechanism - and 
the present document contains the concept and IRP requirements definition. 
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1 Scope 

The present document specifies overall requirements for Notification Log Management over Itf-N. 

Clause 4 provides the Notification Log Management concept for the manipulation of Notification Logs and the retrieval 
of notifications selected for logging. 

Clause 5 of the present document defines the functional requirements for the Notification Log IRP, for the purpose of 
Notification Log Management, as seen from a Network Manager (NM) though Itf-N. The Itf-N is fully standardized so 
as to connect systems of any vendor to an NM via this interface. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 32.101: "Telecommunication management; Principles and high level requirements". 

[2] 3GPP TS 32.102: "Telecommunication management; Architecture". 

[3] 3GPP TS 32.302: "Telecommunication management; Configuration Management (CM); 

Notification Integration Reference Point (IRP): Information Service (IS)". 

[4] 3GPP TS 32.662: "Telecommunication management; Configuration Management (CM); Kernel 

CM Information Service (IS)". 

[5] 3GPP TS 32.1 1 1-1: Telecommunication management; Fault Management; Part 1: 3G fault 

management requirements". 

[6] 3GPP TS 32.1 1 1-2: "Telecommunication management; Fault Management; Part 2: Alarm 

Integration Reference Point (IRP): Information Service (IS)". 

[7] 3GPP TS 32.342: "Telecommunication management; File Transfer (FT) Integration Reference 

Point (IRP): Information Service (IS)". 

[8] ITU-T Recommendation X.735: "Information technology - Open Systems Interconnection - 

Systems Management: Log control function". 

3 Definitions and abbreviations 
3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

Alarm: defined in 3GPP TS 32. 111-1 [5]. 

Alarm Notification: defined in 3GPP TS 32. 1 1 1-1 [5]. 

Event: defined in 3GPP TS 32.111-1 [5]. 
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Fault: defined in 3GPP TS 32.111-1 [5]. 

Notification: defined in 3GPP TS 32.111-1 [5]. 

Notification Log: managed resource in which the notifications are stored 

Notifications logs contain Notification Log Records. Notification Log may represent a physical or a logical/virtual 

storage, and which is not apparent to an IRPManager. 

Notification Log Record: records track information about when a particular notification was entered into the 

Notification Log and the details of the notification 

Each Notification Log Record is associated with one notification, where a notification may be an alarm or an event. 

3.2 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

COTS Commercial Off The Shelf 

EM Element Manager 

IRP Integration Reference Point 

LM Log Management 

NE Network Element 

NM Network Manager 

OS Operations System 



Notification log Management concept 



A general-purpose Notification Logging mechanism is required to hold notifications related to different functional areas 
in the network. 

Any Notification Log must, at any one point in time, be capable of holding fault management alarms, configuration 
management events, performance management events, and event log management events. A log is capable of capturing 
all semantics carried in a notification. 

Only those requirements covered by clause 5 and as applicable to the Notification Log IRP IS shall be considered as 
valid requirements for compliance to the standard defined by the present document. 



4.1 Notification Log Management 



Notification logs are resources in a communications network. An operator needs to be able to create Notification Logs, 
delete Notification Logs, query Notification Logs and to delete records. To allow an operator to do this a Notification 
Log management framework needs to be in place. 

The following aspects for Notification Log Management are derived from ITU-T Recommendation X.735 [8]: 

a) The definition of a flexible Notification Log control service, which will allow selection of Notification Log 
records that are to be logged by a management system (NMs or EMs) in a Notification Log or a particular 
Notification Log. 

b) The ability for a client system to modify the criteria used in logging notification records. 

c) The ability for a client system to determine whether the logging characteristics were modified or whether 
notifications log records has been lost. 

d) Specification of a mechanism to enable Notification Logging to be suspended and subsequently to be resumed. 

e) The ability for a client system to retrieve and delete Notification Log records. 

f) The ability for a client system to create and delete those Notification Logs. 

g) The ability to log partial notifications. 
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Another aspect is listed below: 

Ability to export a log to an industry standard format such as XML. 
Such an export facility would allow the analysis and reporting of logs to be carried out by COTS tools. 

4.2 Detection of the Notification Log state 

The Notification Log management system must notify all interested OS about its current state. An event-based approach 
is used to update OSs on the current state of the Notification Log. 

To facilitate the notification of attribute or state changes, a Notification Log has the capability to generate such events, 
which all OSs may subscribe to via the Notification IRP 3GPP TS 32.302 [3]. 

The Notification Log management system may also emit Notification Log creation and log deletion notifications to 
signal the creation or deletion of a particular log. Again all interested OSs may subscribe via 3GPP TS 32.302 [3] to 
receive such notifications. 

To notify OSs about the loss or imminent loss of Notification Log records, the system is able to emit capacity threshold 
alarms that alert the subscribed OSs that a capacity threshold has been crossed in a particular Notification Log. This 
threshold value may indicate that the Notification Log is full and incoming notifications shall be dealt with in a 
predetermined manner set by an operator. 

The system may emit other events to notify an OS of the completion of an I/O intensive operation, such as deletion of 
Notification Log records, or the exporting of a Notification Log. 

4.3 Notification Log / Notification Log Record Retrieval 

An OS may retrieve Notification Log records either by querying a particular Notification Log with a filter, or by 
exporting a Notification Log, or a particular section of a Notification LogNotification Log. Exporting a Notification 
Log utilizing the File Transfer IRP (3GPP TS 32.342 [7]) allows the OS to retrieve the Notification Log in a standard 
format such as XML. An XML data format may be used by generic XML utilities and next generation web browsers for 
analysis and reporting. XML is a widely accepted data interchange format, and its application to Notification Log 
management provides an ease of use unparalleled in traditional Notification Log systems. 



4.4 Notification Log Full Action 



The OS must be able to set the behaviour of a Notification Log that becomes full. ITU-T Recommendation X.735 [8] 
recommends two actions, halt and wrap. 

A Notification Log that halts when full implies the agent should notify the OS by way of generating a capacity 
threshold alarm. New notifications, which should be logged according to the Notification Log's filter criteria, are 
discarded. This behaviour implies that the old Notification Log records are more important than new ones. 

An OS can set the behaviour of the Notification Log to wrap when full. In this case the Notification Log behaves 
like a circular buffer, replacing the oldest Notification Log records with new ones. This behaviour implies that 
new Notification Log records are more important than old Notification Log records. 
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5 Notification log IRP requirements 

5.1 Management of Logging/Log Records 

The IRPManager may request the IRP Agent to start or stop logging of notifications, or the IRP Agent may initiate 
logging by itself (an IRP Agent may log notifications independent from IRPManager initiated logging). Upon start of 
Notification Logging, the IRP Agent shall generate an identifier for it. All Notification Logging activity identifiers must 
be unique within the IRP Agent. The IRP Agent may alert all interested IRPManagers about the creation of the new 
Notification Logging activity. An initiating IRPManager may request the IRP Agent to stop logging of notifications, and 
the IRP Agent may then alert all interested IRPManagers about the stop of this Notification Logging activity. 

Deletion of Notification Log Records is in the realm of the IRP Agent, where two methods should apply: 

Notification Log Full Action: the IRP Agent should apply the "circular buffer" or "wrap" method (see also 
clause 4.4); a one-time Notification Log threshold capacity alarm (e.g. at 98 % full) will indicate to 
IRPManagers that the IRP Agent is applying this method currently, while clearance will be indicted as well 
(e.g. at 90 % full) 

Maintenance: the IRP Agent may delete Notification Log Records from a Notification Log. 

The IRPManager may request a list of all IRPManager initiated or IRP Agent initiated log activities currently managed 
by the IRP Agent. The IRP Agent returns a list of Notification Log identifiers to the IRPManager. The IRPManager may 
than use these identifiers to query or export a log or parts of it. 

5.2 Information contained in Notification Log / Notification Log 
Records 

A Notification Log may be created by the IRP Agent upon request of the IRPManager, or by the IRP Agent itself. A 
Notification Log may represent a physical or a logical/virtual storage, and which is not apparent to an IRPManager. 

All Notifications available at the IRP Agent for potential transmission over Itf-N shall be logged if requested by a start 
log request, irrespective of the subscriptions and filter settings of IRPManagers. 

The Notification Log Record will contain a notification as specified by 3GPP TS 32.302 [3]. The Notification Log 
Record is time-stamped, allowing the operator to determine the time at which the Notification Log Record was added to 
the Notification Log. 

The IRP Agent should avoid logging the following duplicated or recursive notifications 

Logging of notifications resulting from asynchronous alarm synchronization (3GPP TS 32.111-2 [6]). 

5.3 Notifications emitted by Notification Log IRP 

LM reports are forwarded in real-time to the IRPManager via appropriate filtering located in the IRP Agents. The 
Notification Log IRP reports consist of: 

Notification log starting and stopping reports, upon the activation/deactivation of a Notification Logging activity. 

Notification log capacity threshold reached report, and notification when logging has resumed. 

5.4 Retrieval of Notification Log Records 

The IRPManager will request the IRP Agent to query the notifications log based on filter criteria. The IRP Agent will 
then return the Notification Log Records that match the IRPManager's filter criteria. Each Notification Log Record 
returned will contain a notification that the IRPManager is interested in. 
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5.5 Exporting Notification Log Records 

The IRPManager may request the IRP Agent to export either a Notification Log or part thereof. In this case the 
IRPManager will supply a filter criteria and Notification Log Records matching that criteria will be exported to a 
standard format such as XML defined by the Notification Log IRP. The IRP Agent will provide this export file to an 
IRPManager utilizing the File Transfer IRP (3GPP TS 32.342 [7]). 

5.6 Overview of IRPs related to Notification Log IRP 

The Itf-N interface relies on the Notification IRP 3GPP TS 32.302 [3] as well as File Transfer IRP 

(3GPP TS 32.342 [7]), and serves a number of IRPs. The basic structure of the IRPs is defined in 3GPP TS 32.101 [1] 

and 3GPPTS 32.102 [2]. 

For the purpose of LM, the following IRPs are served: 

- Alarm IRP: Information Service 3GPP TS 32. 1 1 1 -2 [6] . 

- Kernel CM IRP: Information Service 3GPP TS 32.662 [4]. 
All other IRP's emitting notifications. 
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